Re: [kitten] SPAKE and weak checksum types

[Greg Hudson <[e-mail]>]

On 09/13/2017 09:36 PM, Benjamin Kaduk wrote:
>>>> IIUC you are concerned with the case that someone will stand up a kdc
>>>> which will opportunistically use SPAKE, but supports older/weaker
>>>> stuff. By its nature such a beast will be vulnerable to downgrade
>>>> attacks and you can't solve that in SPAKE.
>>>
>>> If the KDC downgrades itself to encrypted timestamp for DES/RC4 keys,
>>> only a passive attack is needed, versus an active attack to downgrade
>>> to encrypted timestamp.
> 
> I must still be foggy from recovering from being sick; could you walk
> me through the passive attack a bit more slowly (or which scenarios are
> being compared)?

The particular scenario I was concerned about here (which should not be
an issue since we appear to have agreement on the text change) was: the
KDC and the client both permit SPAKE and encrypted timestamp.  The KDC
decides not to offer SPAKE because the initial reply key is an RC4 key
and therefore the transcript checksum would use HMAC-MD5.  The passive
attacker can simply dictionary attack the ciphertext from the client (or
the KDC).